Create a Time-Based Okta Access Gateway Policy to Restrict User Access

Administrators can restrict user access to applications based on time by creating a custom policy in Okta Access Gateway (OAG). Okta core does not natively support time-based access restrictions for OAG applications, but administrators can achieve this using custom regular expression policies.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Access Gateway (OAG)
• Custom Policy

There is no option within Okta core to restrict access to OAG apps based on time, but this can be achieved through OAG custom policy.

How does an administrator restrict user access based on time in Okta Access Gateway?

Configure a custom policy under the target application using regular expressions to match or exclude specific timeframes. The operand ~ indicates a regular expression match, and !~ indicates a regular expression non-match.

NOTE: Okta Professional Services handles the creation of custom policies. Contact Okta Support for specific questions regarding custom policies.

Apply the following custom policy configuration to return a 403 error if the local time is outside the hours of 08:00 to 17:00.

ssi on;
if ($date_local !~ "\d{4} (0[8-9]|1[0-6]):[0-5][0-9]:[0-5][0-9] "){
return 403;
}

Apply the following custom policy configuration to return a 403 error if the GMT time is between 03:00:00 and 14:59:59.

ssi on;
      if ($date_gmt ~ "\d{4} [03..14]:[0-5][0-9]:[0-5][0-9]") {
        return 403;
      }

Apply the following configuration to display the time format and download a file with the variable output when accessing the application using variables for local time, GMT, ISO 8601 standard format, and Common Log Format.

ssi on;
echo $date_local $date_gmt $time_iso8601 $time_local;